Re: TMP-files contains login information as plain text
I have sent you an email with a development version of WinSCP to address you have used to register on this forum.
- martin
Post a reply
Topic review
- martin
Re: TMP-files contains login information as plain text
- geraldb
TMP-files contains login information as plain text
Hi,
I've tested including winscp.dll combined with portable winscp.exe in my VB-project. When testing I found some created tmp-files in user's temp directory and these files won't deleted when session crash. These files contains complete parameters as plain text, including user, password, port, server name and other and can be read easily.
Is encrpytion of generated tmp-files intended?
Or is there any way to pre-define name of generated tmp-files when using the winscp.dll? In this case I can define name by myself and overwrite/remove existing tmp-file after executing file transfer. Otherwise this dll is not useful and I have to implement own process starting winscp.exe using all necessary parameters in command string.
Gerald
I've tested including winscp.dll combined with portable winscp.exe in my VB-project. When testing I found some created tmp-files in user's temp directory and these files won't deleted when session crash. These files contains complete parameters as plain text, including user, password, port, server name and other and can be read easily.
Is encrpytion of generated tmp-files intended?
Or is there any way to pre-define name of generated tmp-files when using the winscp.dll? In this case I can define name by myself and overwrite/remove existing tmp-file after executing file transfer. Otherwise this dll is not useful and I have to implement own process starting winscp.exe using all necessary parameters in command string.
Gerald